Surrealdb
110 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Surrealdb, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Surrealdb CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 2 |
| 2024-11 | 3 |
| 2024-12 | 1 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 8 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 1 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 1 |
| 2026-02 | 1 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 5 |
| 2026-07 | 77 |
| 2026-08 | 1 |
| 2026-09 | 0 |
Severity
How the 110 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- High14
- Medium44
Latest CVEs
The 15 most recently published vulnerabilities affecting Surrealdb.
- GHSA-8rw6-p7m8-63jpSurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users—
- CVE-2026-63763SurrealDB before 2.5.0 Privilege Escalation via Future Fields8.8
- CVE-2026-63762SurrealDB before v2.6.1 Denial of Service via scripting6.5
- CVE-2026-63761SurrealDB before 3.1.0 Algorithm Downgrade via ES5124.3
- CVE-2026-63760SurrealDB before 3.1.0 Denial of Service via JSON Parser7.5
- CVE-2026-63759SurrealDB before 3.1.0 Denial of Service nested type annotations6.5
- CVE-2026-63758SurrealDB before 3.1.0 Authorization Bypass via KILL Statement5.4
- CVE-2026-63757SurrealDB before 3.1.0 Session Hijacking via /rpc sessions8.8
- CVE-2026-63756SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition8.1
- CVE-2026-63755SurrealDB before 3.1.0 Permission Bypass via WHERE Clause6.5
- CVE-2026-63754SurrealDB before 3.1.0 Denial of Service via LIVE Query6.5
- CVE-2026-63753SurrealDB before 3.1.0 Authentication Bypass via LIVE Query4.3
- CVE-2026-63751SurrealDB before 3.1.0 Field Permission Bypass via JSON Patch4.3
- CVE-2026-63752SurrealDB before 3.1.0 RELATE Statement Record Overwrite4.3
- CVE-2026-63750SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket5.3
Product grouping is registry-driven, with AI assist and human review. How it works